topic Palo alto redundancy in Next-Generation Firewall Discussions

Palo alto redundancy

janelle.provine — Tue, 23 May 2023 16:03:03 GMT

Other that putting a palo alto in an HA pair are there any other ways to add redundancy?

Re: Palo alto redundancy

BPry — Tue, 23 May 2023 16:08:23 GMT

What sort of redundancy are you looking for? You have HA pairs, HA Clustering, route redundancy if you wanted to fully license two separate boxes outside of HA pairs, or just templating if you have a cold spare unit that you want to keep the configuration up-to-date on.

Re: Palo alto redundancy

janelle.provine — Tue, 23 May 2023 16:13:55 GMT

@BPry

The two boxes are already fully licensed, they are only plugged into one switch and want to know what happens if that one switch fails and how we can get rid of the one point of failure

Re: Palo alto redundancy

BPry — Tue, 23 May 2023 16:21:59 GMT

@janelle.provine,

If they're both connected to the same switch and the switch fails you'd have an outage. Generally how you would fix this is simply having the HA pair and adding switch redundancy. Unfortunately without a second switch there's not much you can do to eliminate the switch being the single point of failure.

Do you have another switch in the environment that you could migrate one of the units to to remove the single point of failure?

Re: Palo alto redundancy

janelle.provine — Tue, 23 May 2023 16:42:48 GMT

@BPry

So if you add another switch, you would have to configure another eth1/? port for HA1 and HA2, and two more (trunk) ports on the second switch for HA1 and HA2?

So something like this